up vote 0 down vote favorite
share [g+] share [fb]

I have a Cisco ASA that authenticates off of RADIUS / AD. I need to give a user VPN access but I want to limit their access to only one host. What is the best way to do this?

link|improve this question
96% accept rate
Which version of the ASA software are you using? ASA 8.4 includes user based access-control which might work for you. – dunxd Nov 17 '11 at 14:46
8.2 and I want to upgrade but wont be able to just for this. – evolvd Nov 17 '11 at 15:37
feedback

1 Answer

up vote 1 down vote accepted

Here is what I ended up doing:

Create a new group-policy that has the split-tunnel with only the host/network I want the VPN user to access. Then create a ACL to only allow network access to what you want. Apply this ACL to the GP with the following command: vpn-filter value (you have to apply this when you are in the GP attributes). Then make a new group-tunnel and tie it back to the new GP. Now you can give this user the new PCF and the user will be locked down to the host / network you specified.

I was hoping to find a solution where I wouldn't have had to make a new GP, TP, and local ASA user but this works I guess.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.